Unwired Server and Device Application Communications

Unwired Server communicates differently with replication, messaging, or Gateway applications.

Replication applications – can use HTTP or HTTPS. By default, the data content in HTTP is unencrypted but compressed. HTTPS keeps the data confidential. For additional security, application developers can add end-to-end encryption (E2EE), in which all the data is encrypted between the device and Unwired Server. By default, the installer generates a key pair that is used by all installations of Unwired Platform. Therefore, you must replace these defaults to avoid compromising security. You can generate new ones, then replace these key pairs in Sybase Control Center. You must then provision the public client key to the device, and configure the device connection profile with the key location. Only then is data encrypted using an AES in cipher-block chaining mode; RSA handles the key exchange. See Encrypting Synchronization for Replication Payloads.
Messaging applications, Hybrid Apps, and Online Data Proxy or OData applications – network traffic uses HTTP or HTTPS. Each HTTP message contains an encrypted message and follows this process:
1. When the messaging server is installed, it generates an RSA key pair.
2. When a device first contacts the server, the device retrieves the public key and the server uses it to secure all future communication. For performance reasons, only a small section of the data from device to server is encrypted with the public key. Other items of note:
  - Administrators can enable autoregistration by setting up an application connection template in Sybase Control Center. Automatic registration means that administrators need neither set up white lists nor generate single-use passwords. For details, see Registering Application Connections in Sybase Control Center for Sybase Unwired Platform.
  - For ODATA applications, developers can use Afaria® to preprovision the RSA public key to the client application.
    However, in non-Afaria environments or for non-ODATA applications excluding those for BlackBerry, Sybase requires that you initially install the messaging application, and connect directly to the messaging service on the corporate LAN (via Wi-Fi, cradle, and so on). Once initial registration is complete, the device can be used outside of the LAN by substituting the connection profile properties to use the Internet-accessible (typically, Relay Server) addresses. See Provisioning Security Artifacts
    
    For BlackBerry devices, because the BES is already inside the LAN, the initial provisioning of the RSA public key is considered safe.
3. Registration adds the user name and authorization code to a white list. When the messaging client connects to the messaging server, it passes the user name, the activation code, and the device and application IDs to the server. The device ID is derived from the hardware. The user name, application ID, and device ID uniquely identify the registration.
4. The device identified by the DeviceID is permanently assigned to that user and added to the white list. For every future interaction, a communication session is initialized using the public key. For the remainder of the session, a rotating sequence of AES keys is used to yield better performance.
All data transferred between the device and the Messaging Server is encrypted in this manner.